1. Field of the Invention
The present invention generally relates to a method and system to create and manage digital cash.
2. Prior Art
A review of digital cash and other forms of electronic payment systems can be found in D. O'Mahony, M. Peirce, and H. Tewari: Electronic Payment Systems (Artech House, Boston, 1997). The basic idea of electronic cash is that a digitally signed statement of value from a bank can be redeemed by the bank as no one else can produce such a statement, as long as the bank keeps track of the statements it has already redeemed. To protect the beneficiary of the statement, encryption will be used in communication, or the delivery has to be made by conventional delivery methods. This basic principle however does not allow for anonymity, which is often considered as one of the main virtues of cash. To overcome this difficulty, David Chaum (D. Chaum “Blind Signature System”, Advances in Cryptology: Proceedings of Crypto 83, Plenum Press, New York, 1984, Pages 153-153) has proposed to use blind signature, which uses the homomorphic property of the RSA protocol for public signature.
This idea has been the starting point of actual use of electronic cash, as offered by the Mark Twain Bank of St. Louis, Mo. for some time starting October 1995. The fact that this operation was not continued is most probably due to the fact that electronic commerce (or e-commerce) was not yet developed enough. The growth of e-commerce as we witness it now will certainly ask for some forms of electronic cash to be available. It is thus important to provide ways to generate and manage electronic cash which would have all the virtues, and avoid the weaknesses, of the solutions originally offered.
One approach to address this need is to use a digital signature Sign. The main property of a digital signature Sign such as RSA which is used for blind signatures is the fact that Sign has some interesting algebraic properties:    1) it is a homomorphism, i.e., Sign(kx)=Sign(k)Sign(x),    2) it is possible to create pairs r, Sign(r) for a random message r. More precisely, anyone can choose Sign(r) at random and then compute r as the function Sign−1 is known publicly.
The basic idea is as follows. Customer C will choose a message x which is going to be the coin. Also, C will generate a pair, k,Sign(k), for a random number k. C sends the product kx to the bank B which will compute Sign(kx). B then sends Sign(kx) to C, using, for instance, a public encryption scheme provided by C, or using some session key exchanged between C and B using a Diffie-Hellman session, or using some other form of communication such as delivery on a diskette transported by an armored carrier. C can then compute Sign(x) by simply dividing Sign(kx) by Sign(k). The pair (x, Sign(x)) is now redeemable by B, at a value usually determined by the signature being used, and B cannot recognize C when some payee P presents (x, Sign(x)), as the knowledge of kx does not allow practical recognition of x nor of Sign(x).
The main problem with the approach described above is that a signature scheme with properties (1) and (2) described above is clearly not secure. Indeed property (2) says that it is easy to forge signatures on random messages. Property (1) says that after seeing the signatures on two messages x1 and x2, it is easy to compute the signature on the message x=x1x2. In order to overcome this problem, valid messages are required to have a special “structure” (e.g., the message x must be encoded using the PKCS#1 standard for digital signature). The hope is that messages with this structure are sparse and hard to forge even given properties (1) and (2) (since messages with that structure will not appear with a significant probability). However, this is simply a hope and is not a proven mathematical property of the signature scheme or of the encoding. The drawback is that it may be possible to discover an algorithm to forge messages even when we restrict them to this structured sparse set.
A provably secure signature scheme instead has the property that even after seeing several signed messages, it is not possible to produce a different valid message. This is a mathematical property of the signature scheme which is proven under some reasonable computational assumption (say the hardness of factoring large integers). Provably secure schemes are known in the cryptographic literature, but for none of them is it known how to create a blinding mechanism.